W E K A
4.4
4.4
  • WEKA v4.4 documentation
    • Documentation revision history
  • WEKA System Overview
    • Introduction
      • WEKA system functionality features
      • Converged WEKA system deployment
    • Cluster capacity and redundancy management
    • Filesystems, object stores, and filesystem groups
    • WEKA networking
    • Data lifecycle management
    • WEKA client and mount modes
    • WEKA containers architecture overview
    • Glossary
  • Planning and Installation
    • Prerequisites and compatibility
    • WEKA cluster installation on bare metal servers
      • Plan the WEKA system hardware requirements
      • Obtain the WEKA installation packages
      • Install the WEKA cluster using the WMS with WSA
      • Install the WEKA cluster using the WSA
      • Manually install OS and WEKA on servers
      • Manually prepare the system for WEKA configuration
        • Broadcom adapter setup for WEKA system
        • Enable the SR-IOV
      • Configure the WEKA cluster using the WEKA Configurator
      • Manually configure the WEKA cluster using the resources generator
        • VLAN tagging in the WEKA system
      • Perform post-configuration procedures
      • Add clients to an on-premises WEKA cluster
    • WEKA Cloud Deployment Manager Web (CDM Web) User Guide
    • WEKA Cloud Deployment Manager Local (CDM Local) User Guide
    • WEKA installation on AWS
      • WEKA installation on AWS using Terraform
        • Terraform-AWS-WEKA module description
        • Deployment on AWS using Terraform
        • Required services and supported regions
        • Supported EC2 instance types using Terraform
        • WEKA cluster auto-scaling in AWS
        • Detailed deployment tutorial: WEKA on AWS using Terraform
      • WEKA installation on AWS using the Cloud Formation
        • Self-service portal
        • CloudFormation template generator
        • Deployment types
        • AWS Outposts deployment
        • Supported EC2 instance types using Cloud Formation
        • Add clients to a WEKA cluster on AWS
        • Auto scaling group
        • Troubleshooting
    • WEKA installation on Azure
      • Azure-WEKA deployment Terraform package description
      • Deployment on Azure using Terraform
      • Required services and supported regions
      • Supported virtual machine types
      • Auto-scale virtual machines in Azure
      • Add clients to a WEKA cluster on Azure
      • Troubleshooting
      • Detailed deployment tutorial: WEKA on Azure using Terraform
    • WEKA installation on GCP
      • WEKA project description
      • GCP-WEKA deployment Terraform package description
      • Deployment on GCP using Terraform
      • Required services and supported regions
      • Supported machine types and storage
      • Auto-scale instances in GCP
      • Add clients to a WEKA cluster on GCP
      • Troubleshooting
      • Detailed deployment tutorial: WEKA on GCP using Terraform
      • Google Kubernetes Engine and WEKA over POSIX deployment
    • WEKA installation on OCI
  • Getting Started with WEKA
    • Manage the system using the WEKA GUI
    • Manage the system using the WEKA CLI
      • WEKA CLI hierarchy
      • CLI reference guide
    • Run first IOs with WEKA filesystem
    • Getting started with WEKA REST API
    • WEKA REST API and equivalent CLI commands
  • Performance
    • WEKA performance tests
      • Test environment details
  • WEKA Filesystems & Object Stores
    • Manage object stores
      • Manage object stores using the GUI
      • Manage object stores using the CLI
    • Manage filesystem groups
      • Manage filesystem groups using the GUI
      • Manage filesystem groups using the CLI
    • Manage filesystems
      • Manage filesystems using the GUI
      • Manage filesystems using the CLI
    • Attach or detach object store buckets
      • Attach or detach object store bucket using the GUI
      • Attach or detach object store buckets using the CLI
    • Advanced data lifecycle management
      • Advanced time-based policies for data storage location
      • Data management in tiered filesystems
      • Transition between tiered and SSD-only filesystems
      • Manual fetch and release of data
    • Mount filesystems
      • Mount filesystems from Single Client to Multiple Clusters (SCMC)
      • Manage authentication across multiple clusters with connection profiles
    • Snapshots
      • Manage snapshots using the GUI
      • Manage snapshots using the CLI
    • Snap-To-Object
      • Manage Snap-To-Object using the GUI
      • Manage Snap-To-Object using the CLI
    • Snapshot policies
      • Manage snapshot policies using the GUI
      • Manage snapshot policies using the CLI
    • Quota management
      • Manage quotas using the GUI
      • Manage quotas using the CLI
  • Additional Protocols
    • Additional protocol containers
    • Manage the NFS protocol
      • Supported NFS client mount parameters
      • Manage NFS networking using the GUI
      • Manage NFS networking using the CLI
    • Manage the S3 protocol
      • S3 cluster management
        • Manage the S3 service using the GUI
        • Manage the S3 service using the CLI
      • S3 buckets management
        • Manage S3 buckets using the GUI
        • Manage S3 buckets using the CLI
      • S3 users and authentication
        • Manage S3 users and authentication using the CLI
        • Manage S3 service accounts using the CLI
      • S3 lifecycle rules management
        • Manage S3 lifecycle rules using the GUI
        • Manage S3 lifecycle rules using the CLI
      • Audit S3 APIs
        • Configure audit webhook using the GUI
        • Configure audit webhook using the CLI
        • Example: How to use Splunk to audit S3
        • Example: How to use S3 audit events for tracking and security
      • S3 supported APIs and limitations
      • S3 examples using boto3
      • Configure and use AWS CLI with WEKA S3 storage
    • Manage the SMB protocol
      • Manage SMB using the GUI
      • Manage SMB using the CLI
  • Security
    • WEKA security overview
    • Obtain authentication tokens
    • Manage token expiration
    • Manage account lockout threshold policy
    • Manage KMS
      • Manage KMS using GUI
      • Manage KMS using CLI
    • Manage TLS certificates
      • Manage TLS certificates using GUI
      • Manage TLS certificates using CLI
    • Manage Cross-Origin Resource Sharing
    • Manage CIDR-based security policies
    • Manage login banner
  • Secure cluster membership with join secret authentication
  • Licensing
    • License overview
    • Classic license
  • Operation Guide
    • Alerts
      • Manage alerts using the GUI
      • Manage alerts using the CLI
      • List of alerts and corrective actions
    • Events
      • Manage events using the GUI
      • Manage events using the CLI
      • List of events
    • Statistics
      • Manage statistics using the GUI
      • Manage statistics using the CLI
      • List of statistics
    • Insights
    • System congestion
    • User management
      • Manage users using the GUI
      • Manage users using the CLI
    • Organizations management
      • Manage organizations using the GUI
      • Manage organizations using the CLI
      • Mount authentication for organization filesystems
    • Expand and shrink cluster resources
      • Add a backend server
      • Expand specific resources of a container
      • Shrink a cluster
    • Background tasks
      • Set up a Data Services container for background tasks
      • Manage background tasks using the GUI
      • Manage background tasks using the CLI
    • Upgrade WEKA versions
    • Manage WEKA drivers
  • Monitor the WEKA Cluster
    • Deploy monitoring tools using the WEKA Management Station (WMS)
    • WEKA Home - The WEKA support cloud
      • Local WEKA Home overview
      • Deploy Local WEKA Home v3.0 or higher
      • Deploy Local WEKA Home v2.x
      • Explore cluster insights
      • Explore performance statistics in Grafana
      • Manage alerts and integrations
      • Enforce security and compliance
      • Optimize support and data management
      • Export cluster metrics to Prometheus
    • Set up WEKAmon for external monitoring
    • Set up the SnapTool external snapshots manager
  • Kubernetes
    • Composable clusters for multi-tenancy in Kubernetes
    • WEKA Operator deployment
    • WEKA Operator day-2 operations
  • WEKApod
    • WEKApod Data Platform Appliance overview
    • WEKApod servers overview
    • Rack installation
    • WEKApod initial system setup and configuration
    • WEKApod support process
  • AWS Solutions
    • Amazon SageMaker HyperPod and WEKA Integrations
      • Deploy a new Amazon SageMaker HyperPod cluster with WEKA
      • Add WEKA to an existing Amazon SageMaker HyperPod cluster
    • AWS ParallelCluster and WEKA Integration
  • Azure Solutions
    • Azure CycleCloud for SLURM and WEKA Integration
  • Best Practice Guides
    • WEKA and Slurm integration
      • Avoid conflicting CPU allocations
    • Storage expansion best practice
  • Support
    • Get support for your WEKA system
    • Diagnostics management
      • Traces management
        • Manage traces using the GUI
        • Manage traces using the CLI
      • Protocols debug level management
        • Manage protocols debug level using the GUI
        • Manage protocols debug level using the CLI
      • Diagnostics data management
  • Appendices
    • WEKA CSI Plugin
      • Deployment
      • Storage class configurations
      • Tailor your storage class configuration with mount options
      • Dynamic and static provisioning
      • Launch an application using WEKA as the POD's storage
      • Add SELinux support
      • NFS transport failback
      • Upgrade legacy persistent volumes for capacity enforcement
      • Troubleshooting
    • Convert cluster to multi-container backend
    • Create a client image
    • Update WMS and WSA
    • BIOS tool
Powered by GitBook
On this page
  • Configure the NFS global settings
  • Configure the NFS cluster level
  • Create an interface group
  • Set interface group ports
  • Remove an interface group port
  • Set interface group IPs
  • Remove an interface group IP range
  • Integrate the NFS and Kerberos service
  • Reset the Kerberos configuration
  • Configure the NFS export level (permissions)
  • Create client access groups
  • Assign a DNS and IP to a client group
  • Remove the DNS or IP of a client group
  • Create NFS client permission
  • Edit NFS client permission
  1. Additional Protocols
  2. Manage the NFS protocol

Manage NFS networking using the GUI

This page describes how to configure the NFS networking using the GUI.

PreviousSupported NFS client mount parametersNextManage NFS networking using the CLI

Last updated 6 months ago

Using the GUI, you can:

Configure the NFS global settings

NFS global settings consist of parameters that enable you to customize various aspects of the NFS service, including the support of the NFS protocol versions, the types of Kerberos authentication to use, and the port for mount requests and NFS locking.

By tailoring these settings, you can ensure that the NFS service meets your needs and requirements, such as supporting NFS V3 and V4 for compatibility with different client systems.

The possible Kerberos authentication types are available only after configuring the Kerberos integration.

Before you begin

To support NFS file-locking, ensure the system meets the prerequisites outlined in .

Procedure

  1. From the menu, select Manage > Protocols.

  2. On the left pane, select NFS.

  3. Select the Settings tab.

  1. In the Global Settings section, select Update, and do the following:

    • Config FS: Select the cluster-wide configuration filesystem that maintains the NFS and Kerberos configurations.

    • Supported Versions: Select the NFS versions you want to support based on your needs. Options include V3, V4, or both.

    • ACL: Sets the ACL to ON (default) or OFF.

    • ACL Type: Defines the default access control method for the share. Options are:

      • None: No ACL enforcement or updates, regardless of existing POSIX ACLs.

      • POSIX (default): Enforces POSIX ACLs, compatible across protocols, but loses NFSv4's finer granularity.

      • NFSv4: Enforces NFSv4 ACLs directly, retaining full granularity, but lacks interoperability with other protocols.

      • Hybrid: Combines both POSIX and NFSv4 ACLs to support interoperability. NFS ensures consistency between the two ACL types, and if any inconsistency arises, POSIX ACL is used for enforcement.

    • Authentication Type: Enable the authentication types that can be used when setting the NFS client permissions. Possible values:

      • NONE: No authentication.

      • SYS: System authentication.

      • KRB5: Basic Kerberos authentication.

      • KRB5i: Kerberos authentication with data integrity.

      • KRB5p: Kerberos authentication with data integrity and privacy.

      The Kerberos authentication types are visible only if Kerberos is configured. Example: KRB5 KRB5i KRB5p. The default values depend on Kerberos configuration:

      • If not configured: NONE SYS

      • If configured: KRB5

    • Mount Port: Set the port that the mountd service binds to.

    • Lock Manager Port: Set the port for the network lock manager’s registration.

    • Status Monitor Port: Set the port for the network status monitor’s registration.

    • Notification Port: Set the port for the notification’s registration.

These ports are only relevant for NFSv3. The default value of 0 indicates using the default published ports.

  1. Select Save to apply the settings.

Configure the NFS cluster level

Configuring the NFS cluster level involves creating an interface group and assigning at least one server with its corresponding port.

Create an interface group

Procedure

  1. From the menu, select Manage > Protocols.

  2. On the left pane, select NFS.

  3. In the Configuration tab, select the + sign near the Interface Groups title.

  1. In the Create Interface Group dialog, set the following properties:

    • Name: A unique interface group name (maximum 11 characters).

    • Gateway: A valid IP address of the gateway.

    • Subnet mask: The subnet mask in CIDR (Classless Inter-Domain Routing) format. For example, a value of 16 equals 255.255.0.0.

  2. Select Save.

Set interface group ports

After creating an interface group, set the ports for this group to establish the NFS cluster. You can only set these ports on frontend containers. To ensure system resiliency, have at least two NFS servers in place.

Repeat this port setting process for each server participating in the NFS cluster.

Procedure

  1. In the Configuration tab, select the interface group.

  2. In the Group Ports table, select +Create.

  3. In the Add Port dialog, set the following properties:

    • Hostname: Select the server on which the port resides.

    • Port: Select the port from the list.

    Select Save.

Example

Remove an interface group port

You might need to remove an interface group due to a change in network configuration, for efficiency, for troubleshooting, during network reorganization, or to replace it with a more suitable group. Always check that the group isn’t in use before you remove it to avoid disruptions.

Procedure

  1. In the Configuration tab, select the interface group.

  2. In the Group Ports table, select the three dots, and from the menu, select Remove.

Set interface group IPs

Floating IPs are not supported in WEKA installations on Azure and GCP.

Procedure

  1. In the Configuration tab, select the interface group.

  2. In the Group IPs table, select +Create.

  3. In the Add Range IP dialog, set the relevant IP range.

  4. Select Save.

Remove an interface group IP range

Procedure

  1. In the Configuration tab, select the interface group.

  2. In the Group IPs table, select the three dots, and from the menu, select Remove.

Integrate the NFS and Kerberos service

Integrating the NFS and Kerberos service is critical to setting up a secure network communication process. This procedure involves defining the Key Distribution Center (KDC) details, administrative credentials, and other parameters to ensure a robust and secure authentication process.

Before you begin

  • Ensure a configuration filesystem is set. See #configure-nfs-global-settings.

  • Ensure the NFS cluster is configured and running. See Configure the NFS cluster level.

  • For Active Directory (AD) integration, obtain the required information from the AD administrator. (WEKA handles the generation of the keytab file.)

  • For MIT integration, obtain the required information from the MIT KDC and OpenLDAP administrators, and a pre-generated keytab file stored in an accessible location is required.

In all KDC and LDAP parameters, use the FQDN format. The hostname part of the FQDN is restricted to a maximum of 20 characters.

Procedure

  1. From the menu, select Manage > Protocols.

  2. On the left pane, select NFS.

  3. Select the Settings tab.

  4. In the Kerberos Authentication section, select Configure.

Configuring the NFS-Kerberos service integration automatically restarts the NFS containers, leading to a temporary disruption in the IO service for connected NFS clients.

  1. Choose the tab that matches your authentication method and follow its instructions.

  1. From the Kerberos Authentication Type, select Active Directory (AD).

  2. Set the following parameters to configure the Kerberos with AD KDC servers:

    • KDC Realm Name: Specifies the realm (domain) used by Kerberos.

    • KDC Primary Server: Identifies the server hosting the primary Key Distribution Center service.

    • KDC Secondary Server: Identifies the server hosting the secondary Key Distribution Center service.

    • KDC Admin Server: Identifies the server hosting the administrative Key Distribution Center service.

  3. Set the following parameters to register the Kerberos service:

    • NFS Service Name: This refers to the complete domain name for a specific NFS server.

    • KDC Realm Admin Name: The username of an administrator who has access to the LDAP directory. This user manages the KDC within a realm.

    • KDC Realm Admin Password: The password of the administrative user who manages the KDC within a realm.

  4. Select Save to apply the changes.

  1. In From the Kerberos Authentication Type, select MIT.

  2. Set the following parameters to the MIT KDC servers:

    1. KDC Realm Name: Specifies the realm (domain) used by Kerberos.

    2. KDC Primary Server: Identifies the server hosting the primary Key Distribution Center service.

    3. KDC Secondary Server: Identifies the server hosting the secondary Key Distribution Center service.

    4. KDC Admin Server: Identifies the server hosting the administrative Key Distribution Center service.

  3. Set the following parameters to register the Kerberos with LDAP service and uploaded keytab file:

    • NFS Service Name: This refers to the complete domain name for a specific NFS server.

    • Upload keytab file: Use the Browse option to upload the pre-generated keytab file. This file contains the keys for the NFS service’s unique identity, known as a principal, in Kerberos.

    • LDAP Server: Specifies the server hosting the Lightweight Directory Access Protocol service.

    • LDAP Domain: Defines the domain that the Lightweight Directory Access Protocol service will access.

    • LDAP Reader User Name: The username of an administrative user, used to generate the keytab file.

    • LDAP Reader User Password: The password of the administrative user.

    • LDAP Base DN: The base Distinguished Name (DN) for the Lightweight Directory Access Protocol directory tree.

    • LDAP Port: The port number on which the Lightweight Directory Access Protocol server listens.

  4. Select Save to apply the changes.

After completing the kerberos integration settings, the enabled authentication type is KRB5. If you want to modify the enabled authentication types, in the Configure NFS Global Settings, select Update, and set the authentication types. See Configure the NFS global settings.

Reset the Kerberos configuration

Resetting the Kerberos configuration is necessary when you need to completely remove the Kerberos service configuration data. Once the data is removed, you can set up a new Kerberos service integration.

Upon resetting the Kerberos configuration, it triggers the following two actions:

  • The NFS containers are restarted, leading to a temporary disruption in the I/O service for connected NFS clients.

  • The authentication types in the NFS Global Settings are reset to their default values.

These actions may impact your system’s performance and functionality. Proceed with caution.

Configure the NFS export level (permissions)

Create client access groups

Creating additional client groups helps in better organization, customization of settings, and enhanced security by segregating access levels.

Procedure

  1. In the Permissions tab, select the + sign near the Client Groups title.

  1. In the Create Client Group dialog, set the client group name.

  2. Select Save.

Assign a DNS and IP to a client group

Assigning a DNS and IP to a client group facilitates network communication and resource access. This step is crucial for the group’s operational functionality.

Procedure

  1. In the NFS configuration, select the Permissions tab.

  2. In the Permissions tab, select Add DNS for the relevant Client Group.

  1. In the Create Client Group DNS Rule dialog, set the DNS server name. Then, select Save.

  1. In the Permissions tab, select Add IP for the relevant Client Group.

  2. In the Create Client Group IP Rule dialog, set the IP address and bitmask. Then, select Save.

Remove the DNS or IP of a client group

Procedure

  1. In the Permissions tab, select the trash symbol displayed next to the DNS or IP for the relevant Client Group.

Create NFS client permission

Creating NFS permissions for a client group enhances access control and efficiency. It allows system administrators to manage access to files, protecting sensitive data and simplifying permission management.

NFS permissions also provide flexibility and foster collaboration. They can be adjusted as needed, especially when a team needs to work on the same files. However, they work best in trusted environments.

Before you begin

If you create an NFS v4 client permission, verify that a global configuration filesystem is already set in the system. See Configure the NFS global settings.

Procedure

  1. In the Permissions table, select +Create.

  1. In the Create NFS Permission dialog, set the following properties:

    • Client Group: The client group to which the permissions are applied.

    • Filesystem: The filesystem to which the permissions are applied. A filesystem with Required Authentication set to ON cannot be used for NFS client permissions.

    • Path: The shared directory path (root share).

    • Type: The access type: RO (read-only) or RW (read/write).

    • Priority: Permissions are processed in ascending priority order during access evaluation, beginning with the lowest number. If a client matches multiple permission entries, the entry with the highest priority number determines the effective permission. Using a numbering system in tens (10, 20, 100) is advisable to facilitate the addition of priorities between existing ones.

    • Supported Versions: The supported NFS versions (V3, V4, or both).

    • User Squash: The system enforces squash mode with the client's permission.

    • Authentication Types: The method of authentication. The enabled authentication types in the NFS global settings determine the possible options and the default. Examples:

      • Enabled types: NONE, SYS, KRB5, KRB5i, KRB5p. Default: KRB5.

      • Enabled types: NONE, SYS. Default: NONE, SYS.

      • Enabled types: NONE, SYS, KRB5i, KRB5p. Default: KRB5i.

    • Anon. UID: Anonymous user ID. Only relevant for Root and All user squashing.

    • Anon. GID: Anonymous group ID. Only relevant for Root and All user squashing.

  2. Select Save.

Edit NFS client permission

You can edit the existing NFS permission settings for a client group. You can also move the priority to the top or bottom priority (related to other client group priorities). If the client group permission setting is no longer required, you can remove it.

Procedure

  1. In the Permissions table, select the three dots of the client group to edit, and select Edit.

  1. Set the relevant properties: Type, Priority, Supported Versions, Squash Root, Authentication Type, Anon. UID, and Anon. GID. Then, select Save.

  2. To move the priority of a client group setting to the top or bottom priority, select Move to top priority or Move to bottom priority.

  3. To remove the client group permission setting, select Remove.

Related topics

Supported NFS client mount parameters

Configure the NFS global settings
Configure the NFS cluster level
Integrate the NFS and Kerberos service
Configure the NFS export level (permissions)
NFS file-locking support
NFS Settings tab
Configure global NFS settings dialog
Add an NFS interface group
Create interface group dialog
Add port dialog
Example: Three servers participate in the NFS cluster
Remove an interface group port
Add range IP dialog
Configure Kerberos authentication over AD dialog
Configure Kerberos authentication over MIT dialog
Add a client group
Create client group dialog
Manage client access groups
Create client group DNS rule dialog
Create client group IP rule dialog
Remove the DNS or IP of a client group
Permissions table
Create NFS permission
Edit a client group permissions